12.22. Nuclear power reactors are designed to produce heat to satisfy the demand for steam by a turbine-generator, up to a specified limit. The reactor control system, with its automatic and manual controls, serves to maintain safe operating conditions as the demand is varied (§5.185 et seq.). Because excess cooling capability is provided in the design of the reactor system, an overpower equal to about 118 percent (in a PWR) or 120 percent (in a В WR) of the rated (or design) power can be tolerated without causing damage to the fuel rods. If the thermal power should exceed the limiting value or if other abnormal conditions which might endanger the system should arise, the reactor protection system would cause reactor trip (or “scram”), as described in Chapter 5.

12.23. In reactor operations, the term transient describes, in general, any significant deviation from the normal value of one or more of the important operating parameters, e. g., system temperatures and pressures, thermal power level, coolant flow rate, turbine trip, equipment failure, etc. If the transient is a minor one, within the permissible operating limits of the system, the controls will be adjusted automatically to compensate for the deviation. A severe transient, however, will activate the reactor protection system.

12.24. The purpose of the protection system is to shut the reactor down and maintain it in a safe condition in the event of a system transient or malfunction that might cause damage to the core, most likely from over­heating. The protection system includes a wide variety of instruments for measuring operating variables and other characteristics of the overall nu­clear plant system. If the instruments indicate a transient that cannot be corrected immediately by the control system, the reactor is shut down automatically by the protection system. In addition, the reactor operator can cause an independent (manual) trip if there are indications that an unsafe condition may be developing.

12.25. When a reactor trip signal is received in a PWR, the electro­magnetic clutches holding up the control rods are deenergized by an au­tomatic cutoff of electric power. The rods then drop into the reactor core. Borated water (boric acid solution) can be injected from the chemical and volume control system or CVCS (§11.99) by manual action to provide a backup to the control rods if required. In a BWR, a rapid shutdown is achieved by forcing the control rods up into the core by hydrostatic pres­sure; at the same time, power to the recirculation pumps is cut off. The reactivity in a BWR can also be decreased by injection of an aqueous solution of sodium pentaborate.

12.26. An essential requirement of the reactor protection system is that it must not fail when needed; on the other hand, an error in the instru­mentation or other malfunction with the system should not cause an un­necessary (“false”) reactor trip. In order to avoid such false trips, three or more redundant channels, consisting of detector and actuator, are used to monitor operating variables. A reactor trip will occur only when two or more channels call for action simultaneously. The availability of several independent channels permits regular testings of the channels, one at a time, without impairing the effectiveness of the protection system.